Live › vulnerability › CVE-2026-114112
Go to dashboardSharp versions before 0.35.4 ship a vulnerable copy of libheif, the HEIF/AVIF decoder. An attacker who supplies a crafted AVIF or HEIF image to an app that processes untrusted images with sharp may run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run npm ls sharp and check the installed version is below 0.35.4.
Check whether the app accepts untrusted AVIF or HEIF uploads and processes them with sharp.
Upgrade sharp to 0.35.4 or later, then reinstall and redeploy.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
This page as .md · .json · in your agent: get_signal("CVE-2026-114112")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.